This repository has no description
2.4 kB
70 lines
1{ config, lib, pkgs, ... }:
2let
3
4 shares = {
5 "/home/lass/sync" = [ "mors" "green" "coaxmetal" "ignavia" ]; # TODO add aergia
6 "/home/lass/tmp/the_playlist" = [ "mors" "prism" "radio" ];
7 # "/home/lass/.weechat" = [ "green" "mors" ];
8 "/home/lass/decsync" = [ "mors" "green" "massulus" "massulus2" ];
9 };
10
11 machine_peers = lib.foldr (host: acc:
12 if builtins.pathExists ../machines/${host}/facts/syncthing.pub then
13 acc // { ${host}.id = lib.removeSuffix "\n" (builtins.readFile ../machines/${host}/facts/syncthing.pub); }
14 else
15 acc
16 ) {} (lib.attrNames (builtins.readDir ../machines));
17
18 all_peers = machine_peers // {
19 "massulus".id = "R2EGJ5S-PQMETUP-C2UGXQG-A6VP7TB-NGSN3MV-C7OGSWT-SZ34L3X-H6IF6AQ";
20 "massulus2".id = "OTJBJNO-VHBCVDL-QSELUS7-S6JDMYR-7WLE36A-6XSRSLP-VKYOYJJ-AHFGZAG";
21 };
22
23 used_peer_names = lib.unique (lib.filter lib.isString (lib.flatten (lib.mapAttrsToList (n: v: v.devices) config.services.syncthing.settings.folders)));
24 used_peers = lib.filterAttrs (n: v: lib.elem n used_peer_names) all_peers;
25in {
26 services.syncthing = {
27 enable = true;
28 group = "syncthing";
29 configDir = "/var/lib/syncthing";
30 key = "${config.krebs.secret.directory}/syncthing.key";
31 cert = "${config.krebs.secret.directory}/syncthing.cert";
32 settings.devices = used_peers;
33 settings.folders = lib.mapAttrs (share: devices: {
34 enable = lib.elem config.networking.hostName devices;
35 path = share;
36 ignorePerms = false;
37 versioning = {
38 type = "trashcan";
39 params = {
40 cleanoutDays = "30";
41 };
42 };
43 devices = devices;
44 }) shares;
45 user = "lass";
46 };
47
48 clanCore.facts.services.syncthing = {
49 secret."syncthing.key" = { };
50 secret."syncthing.cert" = { };
51 public."syncthing.pub" = { };
52 generator.path = with pkgs; [
53 coreutils
54 gnugrep
55 syncthing
56 ];
57 generator.script = ''
58 syncthing generate --config "$secrets"
59 mv "$secrets"/key.pem "$secrets"/syncthing.key
60 mv "$secrets"/cert.pem "$secrets"/syncthing.cert
61 cat "$secrets"/config.xml | grep -oP '(?<=<device id=")[^"]+' | uniq > "$facts"/syncthing.pub
62 '';
63 };
64
65 boot.kernel.sysctl."fs.inotify.max_user_watches" = 524288;
66 networking.firewall = {
67 allowedTCPPorts = [ 22000 ];
68 allowedUDPPorts = [ 21027 ];
69 };
70}